This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch master
in repository 389-ds-base.
commit 93624c38a167ec50e8e81f0bbb4425eb4c59a2b6
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue Apr 25 16:29:04 2017 -0400
Issue 49236 - Fix CI Tests
Description: Fix current CI test failures
https://pagure.io/389-ds-base/issue/49236
Reviewed by: firstyear(Thanks!)
---
.../tests/suites/password/pwp_history_test.py | 3 +
dirsrvtests/tests/suites/plugins/accpol_test.py | 7 +
.../tests/suites/replication/acceptance_test.py | 5 +-
dirsrvtests/tests/tickets/ticket47653MMR_test.py | 2 +
dirsrvtests/tests/tickets/ticket47721_test.py | 4 +-
dirsrvtests/tests/tickets/ticket47931_test.py | 4 +-
dirsrvtests/tests/tickets/ticket48228_test.py | 6 +-
dirsrvtests/tests/tickets/ticket48784_test.py | 170 +++------------------
dirsrvtests/tests/tickets/ticket49039_test.py | 45 ++++--
9 files changed, 80 insertions(+), 166 deletions(-)
diff --git a/dirsrvtests/tests/suites/password/pwp_history_test.py
b/dirsrvtests/tests/suites/password/pwp_history_test.py
index 2e0fb64..2e3b9d5 100644
--- a/dirsrvtests/tests/suites/password/pwp_history_test.py
+++ b/dirsrvtests/tests/suites/password/pwp_history_test.py
@@ -167,6 +167,7 @@ def test_pwp_history_test(topology_st):
except ldap.LDAPError as e:
log.fatal('Failed to attempt to change password: ' + str(e))
assert False
+ time.sleep(1)
try:
topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE,
@@ -205,6 +206,7 @@ def test_pwp_history_test(topology_st):
except ldap.LDAPError as e:
log.fatal('Failed to attempt to reset password: ' + str(e))
assert False
+ time.sleep(1)
# Try and change the password to the previous password before the reset
try:
@@ -212,6 +214,7 @@ def test_pwp_history_test(topology_st):
except ldap.LDAPError as e:
log.fatal('Failed to bind as user: ' + str(e))
assert False
+ time.sleep(1)
try:
topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE,
diff --git a/dirsrvtests/tests/suites/plugins/accpol_test.py
b/dirsrvtests/tests/suites/plugins/accpol_test.py
index 5475f11..8583e72 100644
--- a/dirsrvtests/tests/suites/plugins/accpol_test.py
+++ b/dirsrvtests/tests/suites/plugins/accpol_test.py
@@ -119,6 +119,7 @@ def pwacc_lock(topology_st, suffix, subtree, userid, nousrs):
topology_st.standalone.simple_bind_s(userdn, USER_PASW)
log.error('User {} is not locked, expected error 19'.format(userdn))
nousrs = nousrs - 1
+ time.sleep(1)
def userpw_reset(topology_st, suffix, subtree, userid, nousrs, bindusr, bindpw,
newpasw):
@@ -143,6 +144,7 @@ def userpw_reset(topology_st, suffix, subtree, userid, nousrs,
bindusr, bindpw,
log.error('Unable to reset userPassword for
user-{}'.format(userdn))
raise e
nousrs = nousrs - 1
+ time.sleep(1)
def nsact_inact(topology_st, suffix, subtree, userid, nousrs, action):
@@ -169,6 +171,7 @@ def nsact_inact(topology_st, suffix, subtree, userid, nousrs,
action):
inact =
'{}/ns-inactivate.pl'.format(topology_st.standalone.ds_paths.sbin_dir)
inact_cmd = [inact, '-Z', SERVERID_STANDALONE, '-D',
DN_DM, '-w', PASSWORD, '-I', userdn]
nousrs = nousrs - 1
+ time.sleep(1)
def modify_attr(topology_st, base_dn, attr_name, attr_val):
@@ -181,6 +184,7 @@ def modify_attr(topology_st, base_dn, attr_name, attr_val):
except ldap.LDAPError as e:
log.error('Failed to replace lastLoginTime attribute for user-{}
{}'.format(userdn, e.message['desc']))
assert False
+ time.sleep(1)
def check_attr(topology_st, suffix, subtree, userid, nousrs, attr_name):
@@ -214,6 +218,7 @@ def add_time_attr(topology_st, suffix, subtree, userid, nousrs,
attr_name):
log.error('Failed to add/replace {} attribute to-{}, for
user-{}'.format(attr_name, new_attr_val, userdn))
raise e
nousrs = nousrs - 1
+ time.sleep(1)
def modusr_attr(topology_st, suffix, subtree, userid, nousrs, attr_name, attr_value):
@@ -230,6 +235,7 @@ def modusr_attr(topology_st, suffix, subtree, userid, nousrs,
attr_name, attr_va
log.error('Failed to add/replace {} attribute to-{}, for
user-{}'.format(attr_name, attr_value, userdn))
raise e
nousrs = nousrs - 1
+ time.sleep(1)
def del_time_attr(topology_st, suffix, subtree, userid, nousrs, attr_name):
@@ -246,6 +252,7 @@ def del_time_attr(topology_st, suffix, subtree, userid, nousrs,
attr_name):
log.error('Failed to delete {} attribute for
user-{}'.format(attr_name, userdn))
raise e
nousrs = nousrs - 1
+ time.sleep(1)
def add_users(topology_st, suffix, subtree, userid, nousrs, ulimit):
diff --git a/dirsrvtests/tests/suites/replication/acceptance_test.py
b/dirsrvtests/tests/suites/replication/acceptance_test.py
index 509dc77..e7f33f3 100644
--- a/dirsrvtests/tests/suites/replication/acceptance_test.py
+++ b/dirsrvtests/tests/suites/replication/acceptance_test.py
@@ -91,7 +91,7 @@ def get_repl_entries(topo, entry_name, attr_list):
num_of_masters = len({name: inst for name, inst in topo.ms.items() if not
name.endswith('agmts')})
log.info('Wait for replication to happen')
- time.sleep(5)
+ time.sleep(10)
for num in range(1, num_of_masters + 1):
entries = topo.ms['master{}'.format(num)].search_s(DEFAULT_SUFFIX,
ldap.SCOPE_SUBTREE,
@@ -137,6 +137,7 @@ def test_modify_entry(topo_m4, test_entry):
log.error('Failed to modify entry (%s): error (%s)' % (TEST_ENTRY_DN,
e.message['desc']))
raise e
+ time.sleep(1)
entries = get_repl_entries(topo_m4, TEST_ENTRY_NAME, ["mail"])
assert all(entry["mail"] ==
"{}(a)redhat.com".format(TEST_ENTRY_NAME)
@@ -150,6 +151,7 @@ def test_modify_entry(topo_m4, test_entry):
log.error('Failed to modify entry (%s): error (%s)' % (TEST_ENTRY_DN,
e.message['desc']))
raise e
+ time.sleep(1)
entries = get_repl_entries(topo_m4, TEST_ENTRY_NAME, ["mail"])
assert all(entry["mail"] ==
"{}(a)greenhat.com".format(TEST_ENTRY_NAME)
@@ -163,6 +165,7 @@ def test_modify_entry(topo_m4, test_entry):
log.error('Failed to modify entry (%s): error (%s)' % (TEST_ENTRY_DN,
e.message['desc']))
raise e
+ time.sleep(1)
entries = get_repl_entries(topo_m4, TEST_ENTRY_NAME, ["mail"])
assert all(not entry["mail"] for entry in entries), "Entry attr {}
wasn't replicated successfully".format(
diff --git a/dirsrvtests/tests/tickets/ticket47653MMR_test.py
b/dirsrvtests/tests/tickets/ticket47653MMR_test.py
index 53e921f..f7109d8 100644
--- a/dirsrvtests/tests/tickets/ticket47653MMR_test.py
+++ b/dirsrvtests/tests/tickets/ticket47653MMR_test.py
@@ -269,6 +269,7 @@ def test_ticket47653_modify(topology_m2):
# bind as bind_entry
topology_m2.ms["master1"].log.info("M1: Bind as %s" % BIND_DN)
topology_m2.ms["master1"].simple_bind_s(BIND_DN, BIND_PW)
+ time.sleep(1)
# modify the entry and checks the value
topology_m2.ms["master1"].log.info("M1: Try to modify %s. It should
succeeds" % ENTRY_DN)
@@ -302,6 +303,7 @@ def test_ticket47653_modify(topology_m2):
# Now update the entry on Master2 bound as BIND_DN (update may fail if 47653 is not
fixed on M2)
topology_m2.ms["master1"].log.info("M2: Update %s (bound as %s)"
% (ENTRY_DN, BIND_DN))
topology_m2.ms["master2"].simple_bind_s(BIND_DN, PASSWORD)
+ time.sleep(1)
fail = False
try:
mod = [(ldap.MOD_REPLACE, 'postalCode', '1929')]
diff --git a/dirsrvtests/tests/tickets/ticket47721_test.py
b/dirsrvtests/tests/tickets/ticket47721_test.py
index 495606e..db2ac61 100644
--- a/dirsrvtests/tests/tickets/ticket47721_test.py
+++ b/dirsrvtests/tests/tickets/ticket47721_test.py
@@ -215,10 +215,12 @@ def test_ticket47721_3(topology_m2):
new = _add_custom_at_definition('ATtest3')
topology_m2.ms["master1"].log.info("Update schema (M2) %s " %
new)
topology_m2.ms["master2"].schema.add_schema('attributetypes', new)
+ time.sleep(1)
new = _add_custom_oc_defintion('OCtest3')
topology_m2.ms["master1"].log.info("Update schema (M2) %s " %
new)
topology_m2.ms["master2"].schema.add_schema('objectClasses', new)
+ time.sleep(1)
mod = [(ldap.MOD_REPLACE, 'description', 'Hello world 3')]
dn = "cn=%s0,%s" % (OTHER_NAME, SUFFIX)
@@ -235,7 +237,7 @@ def test_ticket47721_3(topology_m2):
time.sleep(1)
assert loop <= 10
- time.sleep(2)
+ time.sleep(5)
schema_csn_master1 = topology_m2.ms["master1"].schema.get_schema_csn()
schema_csn_master2 = topology_m2.ms["master2"].schema.get_schema_csn()
log.debug('Master 1 schemaCSN: %s' % schema_csn_master1)
diff --git a/dirsrvtests/tests/tickets/ticket47931_test.py
b/dirsrvtests/tests/tickets/ticket47931_test.py
index 9e4d03e..b6fef9f 100644
--- a/dirsrvtests/tests/tickets/ticket47931_test.py
+++ b/dirsrvtests/tests/tickets/ticket47931_test.py
@@ -1,5 +1,5 @@
import threading
-
+import time
import pytest
from lib389.tasks import *
from lib389.utils import *
@@ -108,6 +108,7 @@ def test_ticket47931(topology_st):
except ldap.LDAPError as e:
log.fatal('Failed to configure memberOf plugin: error ' +
e.message['desc'])
assert False
+ time.sleep(1)
# Create group
try:
@@ -132,6 +133,7 @@ def test_ticket47931(topology_st):
# Modify second backend (separate thread)
mod_backend_thrd = modifySecondBackendThread(topology_st.standalone, TIME_OUT)
mod_backend_thrd.start()
+ time.sleep(1)
# Add members to the group - set timeout
log.info('Adding members to the group...')
diff --git a/dirsrvtests/tests/tickets/ticket48228_test.py
b/dirsrvtests/tests/tickets/ticket48228_test.py
index c8df053..08c372e 100644
--- a/dirsrvtests/tests/tickets/ticket48228_test.py
+++ b/dirsrvtests/tests/tickets/ticket48228_test.py
@@ -50,6 +50,7 @@ def set_global_pwpolicy(topology_st, inhistory):
except ldap.LDAPError as e:
log.error('Failed to set passwordInHistory: error ' +
e.message['desc'])
assert False
+ time.sleep(1)
def set_subtree_pwpolicy(topology_st):
@@ -100,12 +101,15 @@ def set_subtree_pwpolicy(topology_st):
except ldap.LDAPError as e:
log.error('Failed to add COS def: error ' + e.message['desc'])
assert False
+ time.sleep(1)
def check_passwd_inhistory(topology_st, user, cpw, passwd):
+
inhistory = 0
log.info(" Bind as {%s,%s}" % (user, cpw))
topology_st.standalone.simple_bind_s(user, cpw)
+ time.sleep(1)
try:
topology_st.standalone.modify_s(user, [(ldap.MOD_REPLACE, 'userpassword',
passwd)])
except ldap.LDAPError as e:
@@ -116,10 +120,10 @@ def check_passwd_inhistory(topology_st, user, cpw, passwd):
def update_passwd(topology_st, user, passwd, times):
- cpw = passwd
for i in range(times):
log.info(" Bind as {%s,%s}" % (user, cpw))
topology_st.standalone.simple_bind_s(user, cpw)
+ time.sleep(1)
cpw = 'password%d' % i
try:
topology_st.standalone.modify_s(user, [(ldap.MOD_REPLACE,
'userpassword', cpw)])
diff --git a/dirsrvtests/tests/tickets/ticket48784_test.py
b/dirsrvtests/tests/tickets/ticket48784_test.py
index 3833be6..e9778ee 100644
--- a/dirsrvtests/tests/tickets/ticket48784_test.py
+++ b/dirsrvtests/tests/tickets/ticket48784_test.py
@@ -23,12 +23,7 @@ RSA = 'RSA'
RSA_DN = 'cn=%s,%s' % (RSA, ENCRYPTION_DN)
ISSUER = 'cn=CAcert'
CACERT = 'CAcertificate'
-M1SERVERCERT = 'Server-Cert1'
-M2SERVERCERT = 'Server-Cert2'
-M1LDAPSPORT = '41636'
-M2LDAPSPORT = '42636'
-M1SUBJECT = 'CN={},OU=389 Directory Server'.format(HOST_MASTER_1)
-M2SUBJECT = 'CN={},OU=390 Directory Server'.format(HOST_MASTER_2)
+SERVERCERT = 'Server-Cert'
@pytest.fixture(scope="module")
@@ -48,24 +43,39 @@ def add_entry(server, name, rdntmpl, start, num):
assert False
-def enable_ssl(server, ldapsport, mycert):
- log.info("\n######################### Enabling SSL LDAPSPORT %s
######################\n" % ldapsport)
- server.simple_bind_s(DN_DM, PASSWORD)
+def enable_ssl(server, ldapsport, copy_serv=False):
+ server.stop()
+ server.nss_ssl.reinit()
+ if copy_serv:
+ ca_cert = copy_serv.get_cert_dir() + "/ca.crt"
+ os.system('cp %s/*.db %s' % (copy_serv.get_cert_dir(),
server.get_cert_dir()))
+ os.system('cp %s %s' % (ca_cert, server.get_cert_dir()))
+ os.system('cp %s/noise* %s' % (copy_serv.get_cert_dir(),
server.get_cert_dir()))
+ os.system('cp %s/p* %s' % (copy_serv.get_cert_dir(),
server.get_cert_dir()))
+ else:
+ server.nss_ssl.create_rsa_ca()
+ server.nss_ssl.create_rsa_key_and_cert()
+ server.start()
+
server.modify_s(ENCRYPTION_DN, [(ldap.MOD_REPLACE, 'nsSSL3', 'off'),
(ldap.MOD_REPLACE, 'nsTLS1', 'on'),
(ldap.MOD_REPLACE, 'nsSSLClientAuth',
'allowed'),
+ (ldap.MOD_REPLACE, 'allowWeakCipher',
'on'),
(ldap.MOD_REPLACE, 'nsSSL3Ciphers',
'+all')])
+ time.sleep(1)
server.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'nsslapd-security',
'on'),
(ldap.MOD_REPLACE, 'nsslapd-ssl-check-hostname',
'off'),
(ldap.MOD_REPLACE, 'nsslapd-secureport',
ldapsport)])
+ time.sleep(1)
server.add_s(Entry((RSA_DN, {'objectclass': "top
nsEncryptionModule".split(),
'cn': RSA,
- 'nsSSLPersonalitySSL': mycert,
+ 'nsSSLPersonalitySSL': SERVERCERT,
'nsSSLToken': 'internal (software)',
'nsSSLActivation': 'on'})))
time.sleep(1)
+ server.restart()
def doAndPrintIt(cmdline, filename):
@@ -96,142 +106,6 @@ def doAndPrintIt(cmdline, filename):
time.sleep(1)
-def create_keys_certs(topology_m2):
- log.info("\n######################### Creating SSL Keys and Certs
######################\n")
-
- global m1confdir
- m1confdir = topology_m2.ms["master1"].confdir
- global m2confdir
- m2confdir = topology_m2.ms["master2"].confdir
-
- log.info("##### shutdown master1")
- topology_m2.ms["master1"].stop(timeout=10)
-
- log.info("##### Creating a password file")
- pwdfile = '%s/pwdfile.txt' % (m1confdir)
- os.system('rm -f %s' % pwdfile)
- opasswd = os.popen("(ps -ef ; w ) | sha1sum | awk '{print $1}'",
"r")
- passwd = opasswd.readline()
- pwdfd = open(pwdfile, "w")
- pwdfd.write(passwd)
- pwdfd.close()
- time.sleep(1)
-
- log.info("##### create the pin file")
- m1pinfile = '%s/pin.txt' % (m1confdir)
- m2pinfile = '%s/pin.txt' % (m2confdir)
- os.system('rm -f %s' % m1pinfile)
- os.system('rm -f %s' % m2pinfile)
- pintxt = 'Internal (Software) Token:%s' % passwd
- pinfd = open(m1pinfile, "w")
- pinfd.write(pintxt)
- pinfd.close()
- os.system('chmod 400 %s' % m1pinfile)
-
- log.info("##### Creating a noise file")
- noisefile = '%s/noise.txt' % (m1confdir)
- noise = os.popen("(w ; ps -ef ; date ) | sha1sum | awk '{print
$1}'", "r")
- noisewdfd = open(noisefile, "w")
- noisewdfd.write(noise.readline())
- noisewdfd.close()
- time.sleep(1)
-
- cmdline = ['certutil', '-N', '-d', m1confdir, '-f',
pwdfile]
- log.info("##### Create key3.db and cert8.db database (master1): %s" %
cmdline)
- doAndPrintIt(cmdline, None)
-
- cmdline = ['certutil', '-G', '-d', m1confdir, '-z',
noisefile, '-f', pwdfile]
- log.info("##### Creating encryption key for CA (master1): %s" % cmdline)
- # os.system('certutil -G -d %s -z %s -f %s' % (m1confdir, noisefile,
pwdfile))
- doAndPrintIt(cmdline, None)
-
- time.sleep(2)
-
- log.info("##### Creating self-signed CA certificate (master1) -- nickname
%s" % CACERT)
- os.system(
- '( echo y ; echo ; echo y ) | certutil -S -n "%s" -s "%s"
-x -t "CT,," -m 1000 -v 120 -d %s -z %s -f %s -2' % (
- CACERT, ISSUER, m1confdir, noisefile, pwdfile))
-
- global M1SUBJECT
- cmdline = ['certutil', '-S', '-n', M1SERVERCERT,
'-s', M1SUBJECT, '-c', CACERT, '-t', ',,', '-m',
'1001', '-v',
- '120', '-d', m1confdir, '-z', noisefile,
'-f', pwdfile]
- log.info("##### Creating Server certificate -- nickname %s: %s" %
(M1SERVERCERT, cmdline))
- doAndPrintIt(cmdline, None)
-
- time.sleep(2)
-
- global M2SUBJECT
- cmdline = ['certutil', '-S', '-n', M2SERVERCERT,
'-s', M2SUBJECT, '-c', CACERT, '-t', ',,', '-m',
'1002', '-v',
- '120', '-d', m1confdir, '-z', noisefile,
'-f', pwdfile]
- log.info("##### Creating Server certificate -- nickname %s: %s" %
(M2SERVERCERT, cmdline))
- doAndPrintIt(cmdline, None)
-
- time.sleep(2)
-
- log.info("##### start master1")
- topology_m2.ms["master1"].start(timeout=10)
-
- log.info("##### enable SSL in master1 with all ciphers")
- enable_ssl(topology_m2.ms["master1"], M1LDAPSPORT, M1SERVERCERT)
-
- cmdline = ['certutil', '-L', '-d', m1confdir]
- log.info("##### Check the cert db: %s" % cmdline)
- doAndPrintIt(cmdline, None)
-
- log.info("##### stop master[12]")
- topology_m2.ms["master1"].stop(timeout=10)
- topology_m2.ms["master2"].stop(timeout=10)
-
- global mytmp
- mytmp = '/tmp'
- m2pk12file = '%s/%s.pk12' % (mytmp, M2SERVERCERT)
- cmd = 'pk12util -o %s -n "%s" -d %s -w %s -k %s' % (m2pk12file,
M2SERVERCERT, m1confdir, pwdfile, pwdfile)
- log.info("##### Extract PK12 file for master2: %s" % cmd)
- os.system(cmd)
- time.sleep(1)
-
- log.info("##### Check PK12 files")
- if os.path.isfile(m2pk12file):
- log.info('%s is successfully extracted.' % m2pk12file)
- else:
- log.fatal('%s was not extracted.' % m2pk12file)
- assert False
-
- log.info("##### Initialize Cert DB for master2")
- cmdline = ['certutil', '-N', '-d', m2confdir, '-f',
pwdfile]
- log.info("##### Create key3.db and cert8.db database (master2): %s" %
cmdline)
- doAndPrintIt(cmdline, None)
-
- log.info("##### Import certs to master2")
- log.info('Importing %s' % CACERT)
- cacert = '%s%s.pem' % (mytmp, CACERT)
- cmdline = ['certutil', '-L', '-n', CACERT, '-d',
m1confdir, '-a']
- doAndPrintIt(cmdline, cacert)
-
- os.system('certutil -A -n "%s" -t "CT,," -f %s -d %s -a -i
%s' % (CACERT, pwdfile, m2confdir, cacert))
- cmd = 'pk12util -i %s -n "%s" -d %s -w %s -k %s' % (m2pk12file,
M2SERVERCERT, m2confdir, pwdfile, pwdfile)
- log.info('##### Importing %s to master2: %s' % (M2SERVERCERT, cmd))
- os.system(cmd)
- log.info('copy %s to %s' % (m1pinfile, m2pinfile))
- os.system('cp %s %s' % (m1pinfile, m2pinfile))
- os.system('chmod 400 %s' % m2pinfile)
- time.sleep(1)
-
- log.info("##### start master2")
- topology_m2.ms["master2"].start(timeout=10)
-
- log.info("##### enable SSL in master2 with all ciphers")
- enable_ssl(topology_m2.ms["master2"], M2LDAPSPORT, M2SERVERCERT)
-
- log.info("##### restart master2")
- topology_m2.ms["master2"].restart(timeout=30)
-
- log.info("##### restart master1")
- topology_m2.ms["master1"].restart(timeout=30)
-
- log.info("\n######################### Creating SSL Keys and Certs Done
######################\n")
-
-
def config_tls_agreements(topology_m2):
log.info("######################### Configure SSL/TLS agreements
######################")
log.info("######################## master1 <-- startTLS -> master2
#####################")
@@ -273,7 +147,9 @@ def test_ticket48784(topology_m2):
"""
log.info("Ticket 48784 - Allow usage of OpenLDAP libraries that don't use
NSS for crypto")
- create_keys_certs(topology_m2)
+ #create_keys_certs(topology_m2)
+ enable_ssl(topology_m2.ms["master1"], '636')
+ enable_ssl(topology_m2.ms["master2"], '637',
topology_m2.ms["master1"])
config_tls_agreements(topology_m2)
add_entry(topology_m2.ms["master1"], 'master1',
'uid=m1user', 0, 5)
diff --git a/dirsrvtests/tests/tickets/ticket49039_test.py
b/dirsrvtests/tests/tickets/ticket49039_test.py
index f0b224c..882332d 100644
--- a/dirsrvtests/tests/tickets/ticket49039_test.py
+++ b/dirsrvtests/tests/tickets/ticket49039_test.py
@@ -19,28 +19,43 @@ else:
log = logging.getLogger(__name__)
USER_DN = 'uid=user,dc=example,dc=com'
+CONFIG_DN = 'cn=config'
+ENCRYPTION_DN = 'cn=encryption,%s' % CONFIG_DN
+RSA = 'RSA'
+RSA_DN = 'cn=%s,%s' % (RSA, ENCRYPTION_DN)
+ISSUER = 'cn=CAcert'
+CACERT = 'CAcertificate'
+SERVERCERT = 'Server-Cert'
def ssl_init(topo):
""" Setup TLS
"""
topo.standalone.stop()
- # Prepare SSL but don't enable it.
- for f in ('key3.db', 'cert8.db', 'key4.db',
'cert9.db', 'secmod.db', 'pkcs11.txt'):
- try:
- os.remove("%s/%s" % (topo.standalone.confdir, f))
- except:
- pass
- assert(topo.standalone.nss_ssl.reinit() is True)
- assert(topo.standalone.nss_ssl.create_rsa_ca() is True)
- assert(topo.standalone.nss_ssl.create_rsa_key_and_cert() is True)
- # Start again
+ topo.standalone.nss_ssl.reinit()
+ topo.standalone.nss_ssl.create_rsa_ca()
+ topo.standalone.nss_ssl.create_rsa_key_and_cert()
topo.standalone.start()
- topo.standalone.rsa.create()
- topo.standalone.config.set('nsslapd-ssl-check-hostname', 'off')
- topo.standalone.config.set('nsslapd-secureport', '%s' %
- SECUREPORT_STANDALONE1)
- topo.standalone.config.set('nsslapd-security', 'on')
+
+ topo.standalone.modify_s(ENCRYPTION_DN,
+ [(ldap.MOD_REPLACE, 'nsSSL3', 'off'),
+ (ldap.MOD_REPLACE, 'nsTLS1', 'on'),
+ (ldap.MOD_REPLACE, 'nsSSLClientAuth',
'allowed'),
+ (ldap.MOD_REPLACE, 'allowWeakCipher',
'on'),
+ (ldap.MOD_REPLACE, 'nsSSL3Ciphers',
'+all')])
+
+ time.sleep(1)
+ topo.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'nsslapd-security',
'on'),
+ (ldap.MOD_REPLACE,
'nsslapd-ssl-check-hostname', 'off'),
+ (ldap.MOD_REPLACE, 'nsslapd-secureport',
'636')])
+
+ time.sleep(1)
+ topo.standalone.add_s(Entry((RSA_DN, {'objectclass': "top
nsEncryptionModule".split(),
+ 'cn': RSA,
+ 'nsSSLPersonalitySSL': SERVERCERT,
+ 'nsSSLToken': 'internal
(software)',
+ 'nsSSLActivation': 'on'})))
+ time.sleep(1)
topo.standalone.restart()
log.info("SSL setup complete\n")
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.